fix(backend): resolve tag commit from full ls-remote advertisement

Author: Christopher Herasme

box-gui/src/box_gui/core/backend_install.py

@@ -263,16 +263,19 @@ def user_site_problems(home: Path | None = None, user_site: Path | None = None)
 
 
 def resolve_tag_commit(url: str, tag: str, *, timeout: float = _LS_REMOTE_TIMEOUT_S) -> str | None:
-    """Resolve one tag to its commit via ``git ls-remote <url> <tag>``.
-
-    Runs git without a shell and prefers the peeled ``^{}`` line for
-    annotated tags, falling back to the plain tag line. Returns the hex
-    commit (40 or 64 chars) or None when the tag is absent, the output is
+    """Resolve one tag to its commit via ``git ls-remote --tags <url>``.
+
+    Fetches the full tag advertisement and filters locally: passing the
+    tag as a pattern suppresses the peeled ``^{}`` line on real forges,
+    which would make an annotated tag resolve to its tag-object hash
+    instead of the commit. Prefers the peeled ``^{}`` line, falling back
+    to the plain tag line for lightweight tags. Returns the hex commit
+    (40 or 64 chars) or None when the tag is absent, the output is
     malformed, or git exits non-zero. Transport errors (OSError,
     SubprocessError) propagate for the caller to treat as fallback.
     """
     proc = subprocess.run(
-        ["git", "ls-remote", url, tag, f"refs/tags/{tag}"],
+        ["git", "ls-remote", "--tags", url],
         capture_output=True,
         text=True,
         timeout=timeout,

box-gui/tests/core/test_backend_install.py

@@ -644,12 +644,17 @@ def test_resolve_tag_commit_prefers_peeled_line(monkeypatch: Any) -> None:
     plain = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
 
     def _fake_run(command: list[str], **kwargs: Any) -> Any:
-        assert command[:2] == ["git", "ls-remote"]
-        assert tag in command
+        # No tag patterns: patterns suppress the peeled ^{} line on real
+        # forges, so the full advertisement is filtered locally instead.
+        assert command == ["git", "ls-remote", "--tags", "https://example.invalid/repo"]
         return subprocess.CompletedProcess(
             command,
             0,
-            stdout=f"{plain}\trefs/tags/{tag}\n{peeled}\trefs/tags/{tag}^{{}}\n",
+            stdout=(
+                f"{plain}\trefs/tags/{tag}\n"
+                f"{peeled}\trefs/tags/{tag}^{{}}\n"
+                "dddddddddddddddddddddddddddddddddddddddd\trefs/tags/26.9.42\n"
+            ),
             stderr="",
         )